FireWall ( with DMZ ) Load Balance

Hi,
I search CCO and find some Firewall load balance document ( http://www.cisco.com/warp/customer/117/fw_load_balancing.html ), but in this sample both firewall havn`t DMZ. Is there anyone can advise me how about the network diagram and hot to configure CSS if both firewall have DMZ?
Best Regards,

Hi,
There are no issues with the firewalls having DMZ's. The firewall load balancing occours accross firewalls regardless of the firewall interface that the incomming packet is destined for.
Regards Brett

Similar Messages

Cache refresh issue with PI Load Balanced HA setup.

Dear Experts,
Wei have installed a HA Load Balanced PI Production Server with the below specifications. Its a four node cluster. Two nodes for Application Cluster and another two nodes for Database Cluster.
Node1
Physical Hostname : axsappci
Virtual Hostname : axsapp00
Instances         : CI,SCS and ASCS.
Node2
Physical Hostname : axsappdi
Virtual Hostname   : axsapp00
Instances          : Dialog instance installed with physical hostname axsappdi
Node3
Physical Hostname : axsappd1
Virtual Hostname   : axsappdb
Instances : DB Instance.
Node4
Physical Hostname : axsappd2
Virtual Hostname   : axsappdb
Instances : Standby DB Instance (passive).
Web Dispatcher Hostname : h2h
Application Switchover : CI,SCS and ASCS to switchover to Node2 and dialog instance Node2 forcing to go down
Database Switchover : DB Instance switchover to Node2 if Node1 fails.
We have changed all the parameters according to note 951910 -> NW2004s High Availability Usage Type PI
I am facing an issue with the cache Notifications in the Integration Repository and Directory. The cache notifications are not happening properly particularly with the ABAP Cache.
I get the below error in my ID when i try to do the manual cache notification.
Unable to notify integration runtime (ABAP) of data changes
Unable to establish http connection "http://h2h:8002/sap/xi/cache?sap-
client=001"
Kindly assist.
Thanks and Regards
Raghu.

Hi Srikanth,
Thanks for the reply.
I have configured my web disptacher to use default HTTP and HTTPS ports i.e 80 and 443. According to note 951910 i have changed parameters in exchange profile to use these ports.
Regards
Raghu.

Testing Forms Services availability with Hardware Load Balancer

I have posted a question about load balancing to a group of application services running Forms Services here on the Forms forum but have had no reply:
Forms Services availability checking for BIGIP Load Balancer
My basic questions are:
a) What do people recommend for load balancing Forms ... least connection, round robin ... ?
b) Do people use http://server:port/forms/frmservlet?ifcmd=status or have some of you used something else?
My reason for the question is we had a Forms Services failure that was not detected by the ifcmd servlet as the HTTP side of things was still working. This meant that the BIGIP load balancer sent everything to the failed server as it had the least connections. So basically no-one could logon.
I've raised an SR with Oracle but they recommend the standard URL above. Has anyone else had a problem like this and if so were you able to fix it?
Regards,
Philippe

Well SR followed up and it looks like the only course of action is to use the standard HTTP check: http://server:port/forms/frmservlet?ifcmd=status ...
... unless that is you want to do some serious customisation. Oracle don't support any other form of checking.
I'm guessing from the lack of responses to this thread that this hasn't been an issue for anybody else ... ???
Any thoughts/suggestions really welcome as we go into production in 4 weeks.
a) What do people recommend for load balancing Forms ... least connection, round robin ... ?
b) Do people use http://server:port/forms/frmservlet?ifcmd=status or have some of you used something else?
Thanks,
Philippe

Bug with Network Load Balancing Services and SkipAsSource always reverting to true

Steps to reproduce:
Add an IP address to the cluster (2 nodes running Windows Server 2012) using the Network Load Balancing Manager
Using PowerShell set the SkipAsSource flag on the IP Address to true (Set-NetIpAddress -IpAddress 192.168.1.10 -SkipAsSource $true). The flag is correctly set.
Try to reverse the setting (Set-NetIpAddress -IpAddress 192.168.1.10 -SkipAsSource $false). Flag stays as true.
It appears as though Network Load Balancing Services is remembering the setting from someone.
Things I've tried all without success (in no particular order):
Removing the IP address from the cluster and adding it back in
Using PowerShell to remove the IP address and add it back in manually (on each host).Flag stays set as true on the 1st node but takes a second before it reverts back to true on the 2nd node.
Using netsh to remove the IP address and add it back in manually (on each host). Flag stays set as true on the 1st node but takes a second before it reverts back to true on the 2nd node.
Deleting each host from the cluster (one at a time), removing the registry keys CurrentControlSet\Services\WLBS and
Removing both hosts from the cluster
Restarting the hosts
Using processmon (sysinternals) to try and find a registry entry that might be set when SkipAsSource is set
Does anyone know:
How to resolve this issue? I'm guessing resetting the TCP/IP stack would work but that's a last resort as it requires an on sight visit to the datacentre.
Where the SkipAsSource flag it stored?
How to reset the master/global cluster config?
Thank in advance,
Antony

Hi Antony,
I am trying to involve someone familiar with this topic to further look at this issue.
There might be some time delay. Appreciate your patience.
Best Regards.
Steven Lee
TechNet Community Support

HTTP Redirect with Global Load Balancing

I've seen a lot of documentation about redirects and what I am trying to do seems simple enough yet I can't get it to work. Here is a summary:
We have two CSSs in different data centers with load balancing in a roundrobin fashion.
User types www.test.com:9086/test.html
User hits one of the CSSes configured to respond to www.test.com, CSS1 and CSS2.
If CSS1 gets the request, it should redirect request to server1:9086/test.html
If CSS2 gets the request, it should redirect request to server2:9086/test.html
Here is a sample of one of the CSSes:
content vTEST
dnsbalance roundrobin
add dns www.test.com
url "/*"
protocol tcp
port 9086
vip address 192.168.3.135
add service rTEST
active
service rTEST
protocol tcp
port 9086
type redirect
keepalive type none
ip address 2.2.2.2
redirect-string "server1:9086/test.html"
active
I've seen a lot of example of using HTTP Redirects, but none of them touch on using global load balancing as we are trying to accomplish.
Now, if I type in a browser:
http://www.test.com:9086/test.html
it fails. Why? because the CSS returns back an IP of 2.2.2.2 for www.test.com, which isn't a real IP address (this is by design). If I type:
http://192.168.3.135:9086/test.html
it works because it successfully redirects to:
http://server1:9086/test.html
because it is going directly against the VIP and redirecting as it should.
So the redirect function we know is working on the CSS as expected. However, the problem is this:
When I ping www.test.com I should get back the VIP address of the content rule (192.168.3.135) and I do UNTIL I ADD THE REDIRECT TYPE to the service. Once I do that if I ping www.test.com I will get back 2.2.2.2. Somehow once the redirect is added the IP address of the service (2.2.2.2) is returned instead of the content VIP (192.168.3.135). That shouldn't happen.
I hope this makes sense and any help would be greatly appreciated!!!

I think what you want to do is explained at :
http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_configuration_example09186a0080094068.shtml
For your information, you should also look at this solution :
http://www.cisco.com/en/US/products/hw/contnetw/ps789/products_configuration_example09186a00801dcd75.shtml
Regards,
Gilles.

LACP with Weighted Load Balancing

Hi,
I am trying to figure out how to use weighted load balancing (WLB) with LACP in Nexus 5K. Please can you give any duidance on this because the documentation I found so far is not helpful.
Basically I have a port channel cosisting of two physical 1G ethernet ports and one backup server connecting with two remote SAN hosts over this port channel. Unfortunately the two remote SAN hosts have similar even mac and ip addresses. Thus ordinary source ip/mac load balancing puts them on the same link in the port channel. I want to apply a weight to try to distribute this load.
Many thanks
Sankung
PS: Ultimately, I am getting a 10G NIC for the backup server but in the meantime want to explore this WLB possibility.

advice : get the apache trace dump to find out what stack it is in. I think you must open a TAR .
The error possibly coming from mod_osso ?

SSL setup with a load balancer

We are running EP 7.0 SP14 and have set it up to run through a Cisco ACE loadbalancer. We have also setup SSL with the certificate on the ACE load balancer. Everythign work fine, except we keep getting a Security Alert popup message in IE that states "You are about to be redirected to a connection that is not secure."
Are there some additional configurations that I need to do in EP to make this go away?
Maximum points to the first correct answer.

You can change logoff URL to any value:
http://help.sap.com/saphelp_nw04s/helpdata/en/44/aada5230be5e77e10000000a155369/frameset.htm
Regarding VC apps.
It is strange you cannot see HTTP in the IEWatch. IE should not be able to alert about something it does not see. I suggest you to use something more substantial to trace network calls: http://www.wireshark.org
This is the best tool I know for network tracing.
Regards,
Slava

Portal Drive not working with external load balancer

Hi,
We have a portal cluster and we are using external Load balancer from
Juniper for load balancing the portal cluster. When given the direct
portal URL (Central instance URL or Dialog instance URL), Portal Drive
is able to connect to portal and shows the KM documents properly. But
when given the Load balancer URL, it gives error saying "Can
not connect to host using WebDAV protocol". Load balancer URL works
fine from the browser without any problems. Any help is highly appreciated.
Helpful points will be rewarded.
Regards,
Chandra

Hi Steve,
For Portal Drive, Windows integrated authentication, client certificates,basic authentication and Kerberos is supported.
(in the default delivery of com.sap.km.cm.docs iview the authentication Scheme is set to basicauthentication - switching that to form based authenticationis not being supportedbywebdav clients).
ALso now Integrated Windows Authentication (NTLM) has been made available with latest patch.
Also read through SAP NOTE 1084683 for further clarifications.
Regards,
Shailesh

11gR2 SCAN config with F5 load balancer

We are getting ready to set up our first RAC 2-node configuration. The hardware had already been purchased before deciding to go with 11gR2. Therefore, we have an F5 load balancer. The question is...can we use the IP address of the F5 in the /etc/hosts file as the SCAN IP address? Would this get us around the need to have a DNS configured SCAN host name?
Has anyone done this before?
Thanks,
Mike

Hi Mike,
Welcome to the forum.
I dont know works F5 Load Balancer.
But i'll try...
The question is...can we use the IP address of the F5 in the /etc/hosts file as the SCAN IP address?Oracle strongly recommends that you do not configure SCAN VIP addresses in the hosts file.
But if you use the hosts file to resolve SCAN name, you can have only one SCAN IP address. You will not get full functionality of the SCAN.
See this note on MOS:
*11gR2 Grid Infrastructure Single Client Access Name (SCAN) Explained [ID 887522.1]*
Would this get us around the need to have a DNS configured SCAN host name?If you want to use the SCAN feature, it is strongly recommended you use the DNS in your environment. This is my advice.
Read the note above or link below to understand how SCAN works
http://levipereira.wordpress.com/2010/12/18/single-client-access-name-scan-by-barb-lundhild/
Regards,
Levi Pereira
Please close your thread when you get the solution to your problem. 
Mark the replies answered "helpful" answer or "correct" answer that will help others with same problem. 
Thanks for doing your part to make this community as valuable as possible for everyone!

Having an issue with vpn load balancing certificate on the vip

Hi all,
I am setting up vpn load balancing in a lab. I have two asa's running 8.6. I created a ucc cert from our internal CA that has the vip as the CN in the cert and the two ASA's themselves as subject alternative names. I used open ssl to create the request. In each asa I am using encryption between the ASA's to encrypt the psk's. Since this is a lab and I do not have the DNS servers at my disposal I've added the hostnames and addresses of each ASA to the config in the ASA's. The problem I have is that when I connect to the vip I get a cert error saying the cert doesn't match the name on the site. See below:
"The security certificate presented by this website was issued for a different website's address."
I have a hostfile on my lab pc connected directly to the outside of the ASA that can resolve the name of the vip but when I browse to the vip I get the cert error. If I click proceed anyway the asa redirects me and the page opens without error on one of the two ASA's.
Does any one know what the CN of the cert should be for vpn load balancing. I thought the CN would be the vip but sometinhg is not right.
Any help is appreciated.
Thanks.

Issue resolved. Switched the order of the trustpoints on the outside and vpn load balance.

Certificate based authentication with SSL load balancer

I've been asked to implement certificate-based authentication (CBA)
on a weblogic cluster serving up web services. I've read through
Chapter 10 (security) and understand the "Identity Assertion" concept.
Environment:
Weblogic 8.1 cluster fronted by a load-balancer that handles SSL and
uses sticky-sessions.
Question:
If the load balancer is used to handle SSL, do I still need to turn
on SSL on the weblogic cluster in order to use CBA? Is there another
way to request the client's certificate?
If the above is yes, what is the minnimal level of SSL? Does it have
to be two-way?
If SSL has to be turned on is there any reason to use the load
balancer's SSL? Is there still a performance benefit?

I think the simplest and most secure way is to have the servers configured for
2-way ssl, since this would ensure that the certificate they receive and use for
authentication has been validated during the ssl handshake. In this case the load
balancer itself does not need to and cannot do the handshaking, and would need
to pass the entire SSL connection through to the WLS server (ie: act similar to
a router)
Pavel.
"George Coller" <[email protected]> wrote:
>
I've been asked to implement certificate-based authentication (CBA)
on a weblogic cluster serving up web services. I've read through
Chapter 10 (security) and understand the "Identity Assertion" concept.
Environment:
Weblogic 8.1 cluster fronted by a load-balancer that handles SSL and
uses sticky-sessions.
Question:
If the load balancer is used to handle SSL, do I still need to turn
on SSL on the weblogic cluster in order to use CBA? Is there another
way to request the client's certificate?
If the above is yes, what is the minnimal level of SSL? Does it have
to be two-way?
If SSL has to be turned on is there any reason to use the load
balancer's SSL? Is there still a performance benefit?

SSO with Webcache Load Balancing ???

Hi,
My system (in Win2K servers)
+Infrastructure sever 9.0.2.3
+Midtier1 using OC4J_BI_Forms 9.0.2.3
+Midtier2 using OC4J_BI_Forms 9.0.2.3
I have followed the Note:207668.1 to setup Webcache as load balancer for 2 Midtiers. I also completed the steps in the Note:241891.1 to re-register the two Midtiers again SSO server.
The system runs well if I start OHS only on the Midtier1 or Midtier2. If I startup both OHS in the two Midtiers, when I connect to our apps using SSO, the SSO login windows is open to aks SSO userid and pass. When I key-in SSO userid and pass, there is an error in the Apache:
apache.exe - Application error: The instruction at "..." could not be read.
Please advice,
Pham

advice : get the apache trace dump to find out what stack it is in. I think you must open a TAR .
The error possibly coming from mod_osso ?

Need help with ACE Load Balancing Base on URL pattern

This is the first time for me trying to configure something like this on the ACE load balancer. I need help configuring a load balancing policy base on URL pattern. URL https://ineedhelp.com base on /willuhelpme and /imlost
Key: ineedhelp_key
cert: ineedhelp_cert
serverfarmA
serverA 10.1.1.1 443
serverfarmB
serverB 10.1.1.2 443
ineedhelp.com/willuhelpme-------serverfarmA
ineedhelp.ocm/imlost---------------serverfarmB

This is the first time for me trying to configure something like this on the ACE load balancer. I need help configuring a load balancing policy base on URL pattern. URL https://ineedhelp.com base on /willuhelpme and /imlost
Key: ineedhelp_key
cert: ineedhelp_cert
serverfarmA
serverA 10.1.1.1 443
serverfarmB
serverB 10.1.1.2 443
ineedhelp.com/willuhelpme-------serverfarmA
ineedhelp.ocm/imlost---------------serverfarmB

How to Configure Multiple Portal Middle Tiers with a Load Balancing Router

Hi,
Portal version trying to install 10.1.2 on Windows 2003 boxes.
I am following the guide http://download.oracle.com/docs/cd/B14099_19/portal.1012/b14037/cg_advnc.htm#i1046354. I have InfraStructure installed on a different box and am trying to install 2 Portal Midtiers each on separate boxes and using LBR. The above document is kind of confusing as I am trying to following
5.3.1 Step 1: Install a Single Portal and Wireless Middle Tier (M1)
5.3.2 Step 2: Configure OracleAS Portal on M1 to Be Accessed Through the LBR (AND FOLLOW ARE THE STEPS 1 to 14 in sequence)
if I follow 1 to 14 steps in sequence the information is not consistent what is being listed in the following sections
5.4.1 Create Virtual Hosts
5.4.2 Configure OracleAS Web Cache
5.4.3 Register OracleAS Portal with OracleAS Single Sign-On
i.e.
ptlconfig -dad portal -sso -host www.abc.com -port 7779
ptlconfig -dad portal -sso -host www.xyz.com -port 7779
as in the above steps it says to run
ptlconfig -dad portal -wc -site
and ssoreg command that always fails because I am running it from midtier as it gives error saying invalid username/password
as oppoesed to steps listed in point 8, 9, 10, 11 and 12.
Can someone please privide the steps in sequence I need to follow when installing 2 midtiers with frontend LBR and one infrastructure. I am trying to follow the architecture listed in the above link.
Any help is really appreciated.
Thanks

Hi,
Will appreciate any inputs on the following.
I am planning to install Infrastructure and one Midtier BI Forms Reports Discoverer, Portal on one windows box and the second midtier BI Forms Discoverer, Portal on the second windows box.
Please correct me if I am wrong on installing and configuring the mid-tiers as following are the steps I have compiled going through the document and want to make sure this time I do it right.
As I'll be installing BI Forms Reports Discoverer, Portal so wondering when I install the second midtier do I need to unselect all Portal, Forms, Reports, Discoverer or just the Portal I need to unselect.
Also in the host file of both the windows boxes do I just need to keep the LBR IP Address entry and remove the rest.
LBR:_
Computer Name: bigip5.prd.com
IP Address: *167.123.2.5*
Listen Port: *80*
Invaidation Port: *9401*
Infrastructure:_
Computer Name: portal1.prd.com
IP Address: *167.123.2.6*
Oracle HTTP Server Listening Port: *7777*
Application Server Control port: *1800*
M1 (Portal & BI Forms Reports Discoverer):_
Computer Name: portal1.prd.com
IP Address: *167.123.2.6*
Oracle HTTP Server Listening Port: *7778*
OracleAS Web Cache Listening Port: *80*
OracleAS Web Cache Invalidation Port: *9401*
OracleAS Web Cache Administration Port: *9400*
Web Cache Statistics port: *9402*
Application Server Control port: *1810*
M2 (Portal & BI Forms Reports Discoverer):_
Computer Name: portal2.prd.com
IP Address: *167.123.2.7*
Oracle HTTP Server Listening Port: *7778*
OracleAS Web Cache Listening Port: *80*
OracleAS Web Cache Invalidation Port: *9401*
OracleAS Web Cache Administration Port: *9400*
Web Cache Statistics port: *9402*
Application Server Control port: *1810*
First to create MetadataRepository and then Install Infrastructure and then follow the below steps to install Midtiers
Install and Configure of M1 (Portal and BI Forms Reports Discoverer):-_
*5.3.1 Step 1*: Install a Single Portal and BI Forms Reports Discoverer (M1 i.e. portal1.prd.com)
*5.3.2 Step 2*: Configure OracleAS Portal and BI Forms Reports Discoverer on M1 to Be Accessed Through the LBR
*1.* Configure LBR
*2.* Follow Section 5.4.1.1 to create the Virtual Host for bigip5.prd.com (LBR) and portal1.prd.com (M1)
*3.* Define a site that matches the virtual host entry for bigip5.prd.com (LBR) on Webcache of M1
*4.* Use OracleAS Web Cache Manager on M1, to map the site bigip5.prd.com (LBR) to middle tier portal1.prd.com (M1).
Follow steps 5 and 6 as per the document
*7.* Configure bigip5.prd.com (LBR) to accept invalidation requests from the OracleAS Metadata Repository on a separate port i.e. 9401
*8.* Change iasconfig.xml on M1
*9.* run ptlconfig -encrypt
*10.* Register the URL changes with OracleAS Portal by running ptlconfig -dad portal -wc -site
*11.* No need as it is http only
*12.* Run the follwoing
MID_TIER_ORACLE_HOME_M1\sso\bin\ssoreg.bat
-site_name bigip5.prd.com
-mod_osso_url http://bigip5.prd.com:80
-config_mod_osso TRUE
-oracle_home_path MID_TIER_ORACLE_HOME_M1
-config_file MID_TIER_ORACLE_HOME_M1\Apache\Apache\conf\osso\osso.conf
-admin_info cn=orcladmin
-virtualhost
*13.* Edit targets.xml to enable monitoring of the LBR's front-end host and port settings for OracleAS Portal
+<Property NAME="PortalListeningHostPort" VALUE=http://bigip5.prd.com:80/>+ and then run
MID_TIER_ORACLE_HOME_M1\bin\emctl reload
*14.* Test the setup
Install and Configure of M2 (Portal and BI Forms Reports Discoverer):-_
*5.3.4 Step 4*: Install a Single Portal and BI Forms Reports Discoverer (M2 i.e. portal2.prd.com)
*1.* As I am installing on wiondows so will not set IASCONFIG_LOC environment variable as I can just copy the iasconfig.xml file from M1 to M2
*2.* Run OUI on M2
*3.* Clear the selection for OracleAS Portal but don't know if I need to unselect Forms , Reports, Discoverer also.
*4.* Enable OracleAS Portal
*5.3.5 Step 5:* Configure the New Middle Tier (M2) to Run Your Existing Portal
*1.* Create both virtual hosts as done on M1
*2.* Copy dads.conf, oradav.conf, cache.conf, web.xml from M1 to M2
*3.* Re-register mod_osso on M2. To do this, perform the following steps by copying osso.conf from M1 to M2
*4.* Synchronize the DCM by using the following command
MID_TIER_ORACLE_HOME_M2/Apache/Apache/bin/ssotransfer MID_TIER_ORACLE_HOME_M2/Apache/Apache/conf/osso/osso.conf
*5.* Run dcmctl updateConfig
*6.* add the necessary mod_rewrite and mod_oc4j directives to the httpd.conf and mod_oc4j.conf files respectively
*7.* Restart Oracle HTTP Server on M2
*8.* Access the OracleAS Web Cache Manager on M1 and follow steps 9,10,11,12,13,14,15,16 for Webcache seetings and clustering.
Also will appreciate if can get some info on the following:
*1.*
When I configure the Webcache as per the Document but if I bring down one Midtier Instance the requests are not going to the other Instance that is up and ignores the case whether an instance is down. Any idea how what and where do I need to provide any setting which in case of instance is down routes the requests to the one that is up.
*2.*
What exactly happens when it says To enable monitoring of the LBR's front-end host and port settings for OracleAS Portal edit target.xml. Is this for LBR to find if an Instance is down or not and route the requests appropriately.
Thanks again for all the help.

Problem with HTTP load balancing

Hello Experts
I have a problem when i do loadbalancing for links like http://1.1.1.1/site/home where 1.1.1.1 is the VIP address (i got http not found), while it is working fine when the link is http://1.1.1.1,
the link is working fine on the real servers for example when i try http://2.2.2.2/site/home it works
by the way, im not doing URL loadbalancing,
any ideas
Thank you in advance

It is generally good idea for this type of cases to get a sniffer trace (in ACE module span 10G backplane interface from supervisor or if ACE appliance take parallel span session of client and server vlan).
This case was investigated in TAC SR and this is a small summary of the traces that may help other users hitting this issue (usually it is good idea to filter by http and client IP) :
This is what we have seen for the non-working scenario.
Packet 1: Client sends HTTP GET to ACE VIP
Packet 2: ACE forwards HTTP GET to RSERVER
Packet 3: RSERVER answers ACE with HTTP 404
Packet 4: ACE forwards the real server response (HTTP 404) to the client
ACE was not changing anything in the packets that were being loadbalanced. And the HTTP 404 error sent from the server that ACE was forwarding indicates that the Web server thinks that the HTTP data stream sent by the client was correct, but simply can not provide the access to the resource specifief by URL.
Bottom line it was found that in this case the server behaves in a different way based on the hostname used to connect to the application, and this should be addressed on the application/server side. An easy way to check this is by using the server name pointing to the vip in local client hostfile.

FireWall ( with DMZ ) Load Balance

Similar Messages

Maybe you are looking for